PHP 紧急修复两个 RCE 漏洞
推荐指数 43.0 NO. 018 · 2026.10.22
发布2026/10/21Score495Comments227
简介
PHP 发布 8.5.12 等四个版本，修复内存管理中的两个关键 RCE 漏洞，未认证攻击者可直接执行服务器代码。所有运行 PHP 的服务器需立即更新，漏洞影响几乎所有请求路径。
编辑判断
PHP 这次漏洞的特殊之处在于攻击面极宽——内存管理是每次请求必经路径，不像之前某些漏洞需要特定扩展或配置才能触发。这意味着传统基于 WAF 或边缘防护的缓解策略基本失效，只能依赖补丁。
更值得行业关注的是 PHP 安全团队披露的处理流程变化：过去两年他们重建了漏洞响应机制，但核心依赖仍是少数维护者的志愿工作。文章末尾罕见地向企业直接喊话要资金支持，反映出基础设施安全维护的可持续性问题正在恶化。如果你所在公司依赖 PHP 且年营收过千万，考虑加入 PHP 基金会或定向资助安全审计，这比出事后的应急响应成本低两个数量级。
社区反馈
负面 164 条评论
核心争论：安全漏洞响应流程混乱， embargo 机制与营销炒作冲突
Sounds like a lot went wrong, the 2024 issue not being patched and then multiple parties leaking stuff before the scheduled release date.
>On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked. This was partly me. I take responsibility for posting it on
> As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. This is the most surprising part to me. It sounds like Calif saw the leaks, interpreted that as embargo being broken, and then raced to publish